@chainpatrol/cli 0.20.0 → 0.22.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @chainpatrol/cli
 
+## 0.22.0
+
+### Minor Changes
+
+- e2b28a5: Expose `contactUrl` (main communication channel) on `orgs list` and `orgs get` output. Add `organization.missing-contact-url` healthcheck. Server-side work in @chainpatrol/external-trpc and @chainpatrol/validation supports the new field and healthcheck; both are private packages and don't need version bumps.
+- b1e35f0: Surface pending Wallet Blocking / Takedown approvals on `orgs list` and `orgs get`. Each org now reports `pendingServiceApprovals` — open requests by lower-level members to enable an approval-gated service (Wallet Blocking / Takedowns) that a higher-up at the org has not yet approved. Adds `--pending-approval-active`, `--pending-approval-inactive`, and `--pending-approval-service <protection|takedowns>` filters to `orgs list` so you can track which organizations are awaiting sign-off, distinct from which have the service turned off. Server-side work in @chainpatrol/external-trpc and @chainpatrol/validation backs the new field and filters; both are private packages and don't need version bumps.
+
+## 0.21.0
+
+### Minor Changes
+
+- b3e77eb: `orgs list` and `orgs get` now surface each organization's "Obligatory
+  Organization Admin Approval" state (`Organization.requiresCustomerReview`)
+  alongside its per-asset-type scope. The new response field is
+  `obligatoryAdminApproval: { active, assetTypes }` — an empty `assetTypes`
+  list with `active: true` means approval applies to every asset type
+  (matches the in-app UI's behaviour when no narrowing has been configured).
+
+  `orgs list` also accepts three new filters that compose with the
+  existing ones via AND:
+
+  - `--obligatory-approval-active` / `--obligatory-approval-inactive` —
+    filter on the toggle itself.
+  - `--obligatory-approval-asset-type <csv>` — return only orgs whose
+    approval scope covers every listed asset type (an org's empty
+    per-asset-type list still counts as "all types"). Passing this flag
+    implies the feature is on, so it can't be combined with
+    `--obligatory-approval-inactive`.
+
+  Server-side work in `@chainpatrol/external-trpc` and `@chainpatrol/validation`
+  extends the `/user/orgs` and `/user/orgs/{slug}` schemas accordingly; both
+  are private packages and don't need version bumps.
+
 ## 0.20.0
 
 ### Minor Changes

package/dist/{chunk-3LJTWYT6.js → chunk-LKITFBIG.js}

@@ -199,6 +199,18 @@ description: |
   "fetch org details", "org info",
   "orgs with takedowns off", "automation off across orgs",
   "which customers have X enabled", "service toggles by org",
+  "obligatory admin approval", "obligatory organization admin approval",
+  "obligatory approval", "admin approval enabled", "admin approval orgs",
+  "requires customer review", "requires admin approval",
+  "orgs that require admin approval", "orgs requiring approval",
+  "which orgs require approval for twitter", "approval scope",
+  "admin approval asset types", "approval per asset type",
+  "pending approval", "pending approvals", "pending service approval",
+  "orgs with pending approval", "pending wallet blocking approval",
+  "pending takedown approval", "awaiting approval", "waiting for approval",
+  "is protection active approval", "wallet blocking approval",
+  "who needs to approve wallet blocking", "service change request",
+  "track orgs with pending approval", "orgs awaiting sign-off",
   "is this URL blocked", "is this domain blocked", "is this address blocked",
   "check this asset", "asset check", "lookup asset status",
   "what is ARCHIVE_ORG", "what does PAGE mean", "list asset types",
@@ -656,14 +668,17 @@ Guide. Key signals in the response:
 
 Use \`--all\` to snapshot every org you have access to instead of a single slug.
 
-### \`orgs list\` \u2014 List organizations with subscription status and service toggles
+### \`orgs list\` \u2014 List organizations with subscription status, service toggles, and admin-approval scope
 
 Returns every organization the caller can see, with each org's
-subscription status (\`PROSPECT\`, \`TRIAL\`, \`ACTIVE\`, \`INTEGRATION\`) and
-which services are active. Use it to answer questions like "which
-customers have takedowns enabled but automation off?" or "which prospects
-don't have detection turned on yet?" \u2014 filters compose with AND and are
-applied server-side, so one call returns the final list.
+subscription status (\`PROSPECT\`, \`TRIAL\`, \`ACTIVE\`, \`INTEGRATION\`),
+which services are active, and the per-org "Obligatory Organization
+Admin Approval" toggle (with its asset-type scope). Use it to answer
+questions like "which customers have takedowns enabled but automation
+off?", "which prospects don't have detection turned on yet?", or "which
+orgs require admin approval before adding Twitter assets to the
+blocklist?" \u2014 filters compose with AND and are applied server-side, so
+one call returns the final list.
 
 \`\`\`bash
 chainpatrol --json orgs list \\
@@ -686,6 +701,34 @@ misleading filters like "reporting.automated=true" that don't mean
 anything. \`detection\` and \`darkWebMonitoring\` have always been
 single-flag services.
 
+#### Obligatory Organization Admin Approval
+
+Each org also has a separate "Obligatory Organization Admin Approval"
+toggle (\`Organization.requiresCustomerReview\` in the schema, surfaced
+on the Services settings page in the app) that gates customer-side
+review of proposals ChainPatrol staff have already approved before
+they're added to the blocklist. It is NOT one of the operational
+services above \u2014 it is an org-policy toggle with its own per-asset-type
+scope.
+
+Each org's response includes:
+
+\`\`\`json
+{
+  "obligatoryAdminApproval": {
+    "active": true,
+    "assetTypes": ["TWITTER", "URL"]
+  }
+}
+\`\`\`
+
+- \`active=true\` + empty \`assetTypes\` means approval applies to
+  **all** asset types \u2014 the org has not narrowed the scope.
+- \`active=true\` + a non-empty \`assetTypes\` list means approval is
+  required only for those asset types.
+- \`active=false\` means no approval is required; \`assetTypes\` is
+  always empty in that case.
+
 So per-org JSON looks like:
 
 \`\`\`json
@@ -697,16 +740,55 @@ So per-org JSON looks like:
     "takedowns":         { "active": true, "automated": false },
     "detection":         { "active": true },
     "darkWebMonitoring": { "active": false }
-  }
+  },
+  "obligatoryAdminApproval": { "active": true, "assetTypes": ["TWITTER"] },
+  "pendingServiceApprovals": [
+    {
+      "service": "protection",
+      "automated": false,
+      "serviceType": "isProtectionActive",
+      "serviceName": "Wallet Blocking",
+      "requestedAt": "2026-05-30T18:04:11.000Z"
+    }
+  ]
 }
 \`\`\`
 
+#### Pending service approvals (Wallet Blocking / Takedowns)
+
+Turning on **Wallet Blocking** (\`protection\`, the "is protection active"
+toggle) or **Takedowns** is approval-gated: when a lower-level org member
+tries to enable one, ChainPatrol records a pending request that a higher-up
+at the org \u2014 an org OWNER, or ChainPatrol staff acting as owner \u2014 must
+approve before the service actually turns on. \`pendingServiceApprovals\`
+lists those open, awaiting-sign-off requests per org.
+
+This is the answer to "which organizations have a pending approval for
+Wallet blocking or Takedown services?" \u2014 it is NOT the same as "which orgs
+have Wallet Blocking turned off". An org can have \`protection.active=false\`
+with **no** pending approval (nobody has asked) OR **with** a pending
+approval (someone asked and it's waiting on an owner). Only
+\`pendingServiceApprovals\` distinguishes the two.
+
+Each entry:
+
+- \`service\` \u2014 \`protection\` (Wallet Blocking) or \`takedowns\`, matching the
+  \`services\` keys.
+- \`automated\` \u2014 \`true\` when the request is for the automated variant
+  (e.g. "Automated Wallet Blocking").
+- \`serviceType\` \u2014 raw enum, e.g. \`isProtectionActive\`.
+- \`serviceName\` \u2014 human label, e.g. \`Wallet Blocking\`.
+- \`requestedAt\` \u2014 when the enable request was submitted (ISO 8601, UTC).
+
+An **empty array means nothing is awaiting approval** \u2014 read \`services\` for
+the current on/off state, never infer it from this field.
+
 When a user asks about "automated reporting / reviewing / protection",
 explain that the flag exists in the DB but has no operational effect and
 isn't exposed by the public API \u2014 only \`takedowns.automated\` carries a
 real meaning.
 
-Filter flags (all optional, all comma-separated lists):
+Filter flags (all optional, all comma-separated lists where noted):
 
 - \`--query <text>\` partial name match (substring, case-insensitive)
 - \`--subscription-status <list>\` one or more of \`PROSPECT\`, \`TRIAL\`,
@@ -719,6 +801,25 @@ Filter flags (all optional, all comma-separated lists):
   meaningful automation toggle. Passing any other service name errors out.
 - \`--service-manual <list>\` services whose automation must be OFF.
   Same restriction \u2014 only \`takedowns\`.
+- \`--obligatory-approval-active\` \u2014 only orgs with admin approval on
+- \`--obligatory-approval-inactive\` \u2014 only orgs with admin approval off
+- \`--obligatory-approval-asset-type <list>\` \u2014 only orgs whose admin
+  approval scope covers EVERY listed asset type. The match treats an
+  org's empty per-asset-type list as "applies to all asset types", so a
+  fully-broad org matches every value passed here. Passing this flag
+  implies the feature is on, so it can't be combined with
+  \`--obligatory-approval-inactive\`. Use the canonical asset-type enum
+  names (\`TWITTER\`, \`URL\`, \`PAGE\`, \u2026); run \`chainpatrol asset types\`
+  to see them all.
+- \`--pending-approval-active\` \u2014 only orgs with at least one open
+  service-enable approval awaiting a higher-up's sign-off.
+- \`--pending-approval-inactive\` \u2014 only orgs with no pending approvals.
+- \`--pending-approval-service <list>\` \u2014 only orgs with a pending approval
+  for one of the listed services. Accepts \`protection\` (Wallet Blocking)
+  and/or \`takedowns\` \u2014 those are the only approval-gated services.
+  Matches both the manual and automated variant. Passing this flag implies
+  a pending approval exists, so it can't be combined with
+  \`--pending-approval-inactive\`.
 
 Service names: \`reporting\`, \`reviewing\`, \`protection\`, \`takedowns\`,
 \`detection\`, \`darkWebMonitoring\`.
@@ -727,16 +828,58 @@ Customers see only orgs they're a member of. Staff/superuser sessions see
 every matching org. The response is the same in both cases; visibility is
 enforced server-side.
 
+#### Use case: finding which orgs require admin approval for an asset type
+
+When a user asks "which orgs require admin approval before blocking
+Twitter assets?", reach straight for the filter \u2014 no client-side
+post-processing needed:
+
+\`\`\`bash
+chainpatrol --json orgs list --obligatory-approval-asset-type TWITTER
+\`\`\`
+
+To audit just the broad opt-ins ("which orgs require approval for
+everything?"), filter on the toggle and inspect \`assetTypes\` in the
+output \u2014 an empty array means "all":
+
+\`\`\`bash
+chainpatrol --json orgs list --obligatory-approval-active \\
+  | jq '.organizations[] | select(.obligatoryAdminApproval.assetTypes | length == 0) | .slug'
+\`\`\`
+
+#### Use case: tracking orgs with a pending Wallet Blocking / Takedown approval
+
+When a user asks "which organizations have a pending approval for Wallet
+blocking or Takedown services?", do NOT reach for \`--service-inactive
+protection\` \u2014 that lists orgs with the service turned OFF, which is a
+different question. Use the pending-approval filter, which surfaces
+staff-initiated enable requests still waiting on a higher-up:
+
+\`\`\`bash
+# Every org with a pending Wallet Blocking OR Takedown approval:
+chainpatrol --json orgs list --pending-approval-service protection,takedowns
+
+# Just Wallet Blocking:
+chainpatrol --json orgs list --pending-approval-service protection
+
+# Any pending approval at all, then read each org's pendingServiceApprovals:
+chainpatrol --json orgs list --pending-approval-active \\
+  | jq '.organizations[] | {slug, pending: [.pendingServiceApprovals[].serviceName]}'
+\`\`\`
+
 ### \`orgs get\` \u2014 Get a single organization by slug
 
 Look up one organization the caller has access to. Returns the same per-org
 shape as a single row from \`orgs list\` \u2014 \`active\` for every service,
 plus \`automated\` on \`takedowns\` only (see the note above on why other
-services don't expose an automation flag). Anything you could read from
-\`orgs list\` you can also read here without paging or filtering. Use it
-when the user names a specific customer ("show me acme's setup", "is
-takedowns automation on for morpho?") and you don't need the rest of the
-catalogue.
+services don't expose an automation flag), plus \`obligatoryAdminApproval\`
+(\`active\` + \`assetTypes\`) and \`pendingServiceApprovals\` (open Wallet
+Blocking / Takedown enable requests awaiting a higher-up's sign-off).
+Anything you could read from \`orgs list\` you can also read here without
+paging or filtering. Use it when the user names a specific customer ("show
+me acme's setup", "is takedowns automation on for morpho?", "does this org
+require admin approval for Twitter?", "is morpho waiting on a Wallet
+Blocking approval?") and you don't need the rest of the catalogue.
 
 \`\`\`bash
 chainpatrol orgs get <slug>

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-3LJTWYT6.js";
+} from "./chunk-LKITFBIG.js";
 import "./chunk-6VTWWGNV.js";
 import {
   DateTime
@@ -532,12 +532,16 @@ var HELP = {
       "--service-active <l>       Comma-separated services that must be active",
       "--service-inactive <l>     Comma-separated services that must be inactive",
       "--service-automated <l>    Services whose automation must be ON (only `takedowns` is accepted \u2014 the other services have no meaningful automation toggle)",
-      "--service-manual <l>       Services whose automation must be OFF (only `takedowns` is accepted)"
+      "--service-manual <l>       Services whose automation must be OFF (only `takedowns` is accepted)",
+      "--pending-approval-active     Only orgs with an open service-enable approval awaiting a higher-up's sign-off",
+      "--pending-approval-inactive   Only orgs with no pending service-enable approvals",
+      "--pending-approval-service <l> Only orgs with a pending approval for the listed service(s) \u2014 `protection` (Wallet Blocking) and/or `takedowns`"
     ],
     examples: [
       "chainpatrol orgs list --subscription-status ACTIVE",
       "chainpatrol orgs list --service-active takedowns --service-manual takedowns",
-      "chainpatrol --json orgs list --subscription-status ACTIVE,TRIAL --service-active detection"
+      "chainpatrol --json orgs list --subscription-status ACTIVE,TRIAL --service-active detection",
+      "chainpatrol --json orgs list --pending-approval-service protection,takedowns"
     ]
   },
   "orgs get": {
@@ -916,6 +920,12 @@ ${getTopLevelHelp()}
     serviceInactive: { type: "string" },
     serviceAutomated: { type: "string" },
     serviceManual: { type: "string" },
+    obligatoryApprovalActive: { type: "boolean" },
+    obligatoryApprovalInactive: { type: "boolean" },
+    obligatoryApprovalAssetType: { type: "string" },
+    pendingApprovalActive: { type: "boolean" },
+    pendingApprovalInactive: { type: "boolean" },
+    pendingApprovalService: { type: "string" },
     query: { type: "string" },
     assetType: { type: "string" },
     takedownStatus: { type: "string" },
@@ -1558,7 +1568,7 @@ async function main() {
     }
     case "orgs": {
       if (subcommand === "list") {
-        const { runOrgsList } = await import("./list-QXA6GLCV.js");
+        const { runOrgsList } = await import("./list-JK4SRMPL.js");
         await runOrgsList({
           query: cli.flags.query,
           subscriptionStatus: cli.flags.subscriptionStatus,
@@ -1566,6 +1576,12 @@ async function main() {
           serviceInactive: cli.flags.serviceInactive,
           serviceAutomated: cli.flags.serviceAutomated,
           serviceManual: cli.flags.serviceManual,
+          obligatoryApprovalActive: cli.flags.obligatoryApprovalActive,
+          obligatoryApprovalInactive: cli.flags.obligatoryApprovalInactive,
+          obligatoryApprovalAssetType: cli.flags.obligatoryApprovalAssetType,
+          pendingApprovalActive: cli.flags.pendingApprovalActive,
+          pendingApprovalInactive: cli.flags.pendingApprovalInactive,
+          pendingApprovalService: cli.flags.pendingApprovalService,
           json: jsonMode,
           outputFormat: cliContext.outputFormat
         });
@@ -1574,7 +1590,7 @@ async function main() {
       if (subcommand === "get") {
         const positionalSlug = action;
         const slug = positionalSlug ?? await tryResolveOrg();
-        const { runOrgsGet } = await import("./get-K7VHV5X2.js");
+        const { runOrgsGet } = await import("./get-GTACVCLE.js");
         await runOrgsGet({
           slug,
           json: jsonMode,
@@ -1705,12 +1721,12 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-A36WQLMU.js");
+      const { setupSkill } = await import("./setup-skill-V3HDWN7T.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-A36WQLMU.js");
+      const { uninstallSkill } = await import("./setup-skill-V3HDWN7T.js");
       uninstallSkill({ json: jsonMode });
       break;
     }

package/dist/{get-K7VHV5X2.js → get-GTACVCLE.js}

@@ -26,6 +26,18 @@ function summarizeServices(org) {
   if (org.services.darkWebMonitoring.active) parts.push("darkWebMonitoring");
   return parts.length > 0 ? parts.join(" ") : "(no services enabled)";
 }
+function summarizeObligatoryAdminApproval(org) {
+  if (!org.obligatoryAdminApproval.active) return "off";
+  const types = org.obligatoryAdminApproval.assetTypes;
+  return types.length === 0 ? "on (all asset types)" : `on (${types.join(", ")})`;
+}
+function summarizePendingApprovals(org) {
+  if (org.pendingServiceApprovals.length === 0) return "none";
+  const labels = Array.from(
+    new Set(org.pendingServiceApprovals.map((approval) => approval.serviceName))
+  );
+  return labels.join(", ");
+}
 async function runOrgsGet(options) {
   const slug = options.slug?.trim();
   if (!slug) {
@@ -44,13 +56,17 @@ async function runOrgsGet(options) {
     markdown: [
       `# ${organization.name} (\`${organization.slug}\`)`,
       "",
+      `- Contact URL: ${organization.contactUrl ?? "(not set)"}`,
       `- Subscription status: ${organization.subscriptionStatus}`,
-      `- Services: ${summarizeServices(organization)}`
+      `- Services: ${summarizeServices(organization)}`,
+      `- Obligatory admin approval: ${summarizeObligatoryAdminApproval(organization)}`,
+      `- Pending service approvals: ${summarizePendingApprovals(organization)}`
     ].join("\n"),
     csv: toCsvRows([
       {
         slug: organization.slug,
         name: organization.name,
+        contactUrl: organization.contactUrl ?? "",
         subscriptionStatus: organization.subscriptionStatus,
         reportingActive: organization.services.reporting.active,
         reviewingActive: organization.services.reviewing.active,
@@ -59,13 +75,32 @@ async function runOrgsGet(options) {
         // `takedowns` is the only service with a meaningful automation flag.
         takedownsAutomated: organization.services.takedowns.automated,
         detectionActive: organization.services.detection.active,
-        darkWebMonitoringActive: organization.services.darkWebMonitoring.active
+        darkWebMonitoringActive: organization.services.darkWebMonitoring.active,
+        obligatoryAdminApprovalActive: organization.obligatoryAdminApproval.active,
+        // Empty list + active=true means "applies to all asset types" — read
+        // the active column alongside this one to interpret.
+        obligatoryAdminApprovalAssetTypes: organization.obligatoryAdminApproval.assetTypes.join("|"),
+        // Pending staff requests to enable Wallet Blocking / Takedowns that a
+        // higher-up has not yet approved. Raw `serviceType` enum values,
+        // de-duplicated; an empty cell means nothing is awaiting approval.
+        pendingServiceApprovals: Array.from(
+          new Set(
+            organization.pendingServiceApprovals.map((approval) => approval.serviceType)
+          )
+        ).join("|")
       }
     ]),
     human: () => {
       console.log(`${organization.name}  (slug: ${organization.slug})`);
+      console.log(`  contactUrl: ${organization.contactUrl ?? "(not set)"}`);
       console.log(`  subscriptionStatus: ${organization.subscriptionStatus}`);
       console.log(`  services: ${summarizeServices(organization)}`);
+      console.log(
+        `  obligatoryAdminApproval: ${summarizeObligatoryAdminApproval(organization)}`
+      );
+      console.log(
+        `  pendingServiceApprovals: ${summarizePendingApprovals(organization)}`
+      );
     }
   });
 }

package/dist/{list-QXA6GLCV.js → list-JK4SRMPL.js}

@@ -29,6 +29,7 @@ var SINGLE_SERVICES = [
   "darkWebMonitoring"
 ];
 var ALL_SERVICES = [...DUAL_SERVICES, ...SINGLE_SERVICES];
+var PENDING_APPROVAL_SERVICES = ["protection", "takedowns"];
 function splitCsv(value) {
   if (!value) return [];
   return value.split(",").map((part) => part.trim()).filter(Boolean);
@@ -128,13 +129,83 @@ function summarizeServices(org) {
   }
   return parts.length > 0 ? parts.join(" ") : "(no services enabled)";
 }
+function summarizeObligatoryAdminApproval(org) {
+  if (!org.obligatoryAdminApproval.active) return "off";
+  const types = org.obligatoryAdminApproval.assetTypes;
+  return types.length === 0 ? "on (all asset types)" : `on (${types.join(", ")})`;
+}
+function buildObligatoryAdminApprovalFilter(options) {
+  if (options.obligatoryApprovalActive && options.obligatoryApprovalInactive) {
+    throw new CliExitError(
+      "Conflicting flags: --obligatory-approval-active and --obligatory-approval-inactive can't both be passed.",
+      ExitCode.USAGE
+    );
+  }
+  const assetTypeStrings = splitCsv(options.obligatoryApprovalAssetType).map(
+    (value) => value.toUpperCase()
+  );
+  if (assetTypeStrings.length > 0 && options.obligatoryApprovalInactive) {
+    throw new CliExitError(
+      "Conflicting flags: --obligatory-approval-asset-type implies the feature is on, so it can't be combined with --obligatory-approval-inactive.",
+      ExitCode.USAGE
+    );
+  }
+  const filter = {};
+  if (options.obligatoryApprovalActive) filter.active = true;
+  if (options.obligatoryApprovalInactive) filter.active = false;
+  if (assetTypeStrings.length > 0) filter.assetTypes = assetTypeStrings;
+  return Object.keys(filter).length > 0 ? filter : void 0;
+}
+function parsePendingApprovalServices(raw) {
+  const parts = splitCsv(raw);
+  const result = [];
+  for (const part of parts) {
+    if (!PENDING_APPROVAL_SERVICES.includes(part)) {
+      throw new CliExitError(
+        `Unknown service '${part}' in --pending-approval-service. Only ${PENDING_APPROVAL_SERVICES.join(", ")} can require approval.`,
+        ExitCode.USAGE
+      );
+    }
+    result.push(part);
+  }
+  return result;
+}
+function buildPendingServiceApprovalFilter(options) {
+  if (options.pendingApprovalActive && options.pendingApprovalInactive) {
+    throw new CliExitError(
+      "Conflicting flags: --pending-approval-active and --pending-approval-inactive can't both be passed.",
+      ExitCode.USAGE
+    );
+  }
+  const services = parsePendingApprovalServices(options.pendingApprovalService);
+  if (services.length > 0 && options.pendingApprovalInactive) {
+    throw new CliExitError(
+      "Conflicting flags: --pending-approval-service implies a pending approval exists, so it can't be combined with --pending-approval-inactive.",
+      ExitCode.USAGE
+    );
+  }
+  const filter = {};
+  if (options.pendingApprovalActive) filter.active = true;
+  if (options.pendingApprovalInactive) filter.active = false;
+  if (services.length > 0) filter.services = services;
+  return Object.keys(filter).length > 0 ? filter : void 0;
+}
+function summarizePendingApprovals(org) {
+  if (org.pendingServiceApprovals.length === 0) return "none";
+  const labels = Array.from(
+    new Set(org.pendingServiceApprovals.map((approval) => approval.serviceName))
+  );
+  return labels.join(", ");
+}
 async function runOrgsList(options) {
   const client = options.apiClient ?? createApiClient();
   const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
   const input = {
     query: options.query ?? "",
     subscriptionStatus: parseSubscriptionStatuses(options.subscriptionStatus),
-    services: buildServicesFilter(options)
+    services: buildServicesFilter(options),
+    obligatoryAdminApproval: buildObligatoryAdminApprovalFilter(options),
+    pendingServiceApproval: buildPendingServiceApprovalFilter(options)
   };
   const result = await client.getUserOrgs(input);
   const organizations = result.organizations;
@@ -145,13 +216,14 @@ async function runOrgsList(options) {
       `# Organizations (${organizations.length})`,
       "",
       ...organizations.map(
-        (org) => `- \`${org.slug}\` \u2014 ${org.name} \u2014 ${org.subscriptionStatus} \u2014 ${summarizeServices(org)}`
+        (org) => `- \`${org.slug}\` \u2014 ${org.name} \u2014 ${org.subscriptionStatus} \u2014 contact: ${org.contactUrl ?? "(not set)"} \u2014 ${summarizeServices(org)} \u2014 admin-approval: ${summarizeObligatoryAdminApproval(org)} \u2014 pending-approval: ${summarizePendingApprovals(org)}`
       )
     ].join("\n"),
     csv: toCsvRows(
       organizations.map((org) => ({
         slug: org.slug,
         name: org.name,
+        contactUrl: org.contactUrl ?? "",
         subscriptionStatus: org.subscriptionStatus,
         reportingActive: org.services.reporting.active,
         reviewingActive: org.services.reviewing.active,
@@ -160,7 +232,19 @@ async function runOrgsList(options) {
         // `takedowns` is the only service with a meaningful automation flag.
         takedownsAutomated: org.services.takedowns.automated,
         detectionActive: org.services.detection.active,
-        darkWebMonitoringActive: org.services.darkWebMonitoring.active
+        darkWebMonitoringActive: org.services.darkWebMonitoring.active,
+        obligatoryAdminApprovalActive: org.obligatoryAdminApproval.active,
+        // Empty list + active means "applies to all asset types"; we keep
+        // the cell empty in CSV so spreadsheets render it as the natural
+        // "no narrowing" value — pair it with the active column.
+        obligatoryAdminApprovalAssetTypes: org.obligatoryAdminApproval.assetTypes.join("|"),
+        // Pending staff requests to enable Wallet Blocking / Takedowns that
+        // a higher-up has not yet approved. We emit the raw `serviceType`
+        // enum values (de-duplicated) so the column is machine-filterable;
+        // an empty cell means nothing is awaiting approval.
+        pendingServiceApprovals: Array.from(
+          new Set(org.pendingServiceApprovals.map((approval) => approval.serviceType))
+        ).join("|")
       }))
     ),
     human: () => {
@@ -172,8 +256,9 @@ async function runOrgsList(options) {
       const slugWidth = Math.max(...organizations.map((org) => org.slug.length), 4);
       const nameWidth = Math.max(...organizations.map((org) => org.name.length), 4);
       for (const org of organizations) {
+        const contact = org.contactUrl ?? "(no contact)";
         console.log(
-          `  ${org.slug.padEnd(slugWidth)}  ${org.name.padEnd(nameWidth)}  ${org.subscriptionStatus.padEnd(11)}  ${summarizeServices(org)}`
+          `  ${org.slug.padEnd(slugWidth)}  ${org.name.padEnd(nameWidth)}  ${org.subscriptionStatus.padEnd(11)}  ${contact}  ${summarizeServices(org)}  admin-approval=${summarizeObligatoryAdminApproval(org)}  pending-approval=${summarizePendingApprovals(org)}`
         );
       }
     }

package/dist/{setup-skill-A36WQLMU.js → setup-skill-V3HDWN7T.js}

@@ -6,7 +6,7 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-3LJTWYT6.js";
+} from "./chunk-LKITFBIG.js";
 import "./chunk-6VTWWGNV.js";
 export {
   getBundledSkillContent,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [